Energy: Utility Infrastructure AI Safety, Oversight, and Workforce Protection Act.
What changed between versions
The bill's core approach changed from directly imposing specific operational requirements on utilities to requiring the PUC to adopt standards by January 1, 2028 that will contain those requirements. This gives the commission flexibility to tailor rules through rulemaking rather than fixing them in statute.
Direct regulatory obligations now focus on electrical corporations and gas corporations (privately owned utilities). Community choice aggregators and local publicly owned electric utilities have a lighter obligation to adopt a policy consistent with PUC standards, rather than being subject to the same detailed requirements as privately owned utilities.
All detailed operational sections were removed, including: mandatory 18-month staging mode before deployment, 24-hour incident reporting and 30-day root-cause reports, safety plan filing requirements with specific content (model version, training data, bias testing, cybersecurity controls), system records modification rules, annual monitoring reports, and audit trail retention requirements.
A new standard requirement was added in Section 8511(a)(6) requiring PUC standards to 'identify and establish requirements for human review and approval of any use of artificial intelligence that is high risk, safety sensitive, or would have a material operational impact.' This serves as a catch-all provision.
The workforce protection provision in Section 8511(a)(5) was strengthened: the April version required utilities to self-demonstrate sufficient staffing for human review, while the May version adds that staffing levels must be 'sufficient to support meaningful human review and approval processes, as determined by the commission,' shifting the determination authority to the PUC.
The 180-day advance notice requirement to labor organizations before introducing technological changes involving AI, the joint retraining program requirement, and the prohibition on layoffs without exhausting retraining/redeployment options were all removed from the bill text.
The term 'automated decision system' (with its detailed definition and exclusions like spam filters, firewalls, calculators) was replaced with 'artificial intelligence model' defined as an engineered or machine-based system that infers from input how to generate outputs. The definitions for 'high-risk automated decision system,' 'provenance log,' 'staging mode,' 'system records,' 'technological change,' and 'vendor supply chain disclosure' were all removed.
Specific enforcement provisions were removed, including penalties under Section 2108 and Section 2110 of the Public Utilities Code for privately owned utilities, and the annual compliance certification requirement for publicly owned utilities to their governing board and the Energy Commission.